secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for.

Is there another, more widely used public key cryptography scheme with the same property?

• Do you know of any threshold signature schemes that are not discrete-log based but have better-than-generic performance for combining already-existing verification keys? $\;$ – user991 Apr 26 '15 at 7:00
• Your upper paragraph does squarely address the question. $\:$ I was just wondering if your lower paragraph was more related to the question than it seemed. $\;\;\;\;$ – user991 Apr 26 '15 at 7:08